5 ms·
Good. They're trying to clean up all the private data leaked everywhere. I tempted to say "why couldn't they figure out this google dork themselves" but they've
by danielweber 10y ago
Good. They're trying to clean up all the private data leaked everywhere. I tempted to say "why couldn't they figure out this google dork themselves" but they've probably been slammed for the past 7 days cleaning up a bunch of stuff anyway.
- taviso 10y agoYou have no idea.
- danielweber 10y agoYour hard work is appreciated.
- mintplant 10y agoFYI, I'm seeing some more of these results show up (with active caches) for the following searches: "CF-RAY" "CF-Force-Miss-TS" "X-SSL-Server-Name" "Internal Upstream Server Certificate0"
- deleted 10y ago[deleted]
- clowd 10y agoThe effort you're putting into cleaning up someone else's mess cannot be understated, nor can it be sufficiently appreciated. Thanks!
- pseudopseudonym 10y agoThank you for all your hard work.
- ec109685 10y agoAny chance you can describe why these cached pages missed the purge that cloudflare initiated? Seems like cloudflare should have brought an outside expert to try to exploit this issue before the disclosure was made.
- tptacek 10y agoFor vulnerabilities with immediate exploit exposure, where people are currently being victimized by the flaw, Project Zero has a 7-day embargo. The short waiting period balances the vendor's interest in coordinating the smoothest fix to the problem with the public's interest in knowing its exposure and maximizing it's options for reacting to the exposure. The fixed waiting period keeps the process sane. Every vendor you'll ever disclose a serious vulnerability to will try to delay disclosure, usually repeatedly. If you set a precedent of making arbitrary exceptions, you'll never be able to stare anyone down. Again: as the reporters, you're trying to balance the vendor's interests with those of the public. Your credibility in these situations is pretty important, not just for this vulnerability, but for the next ones. With P0, we all know there will be a long series of "next ones" to be concerned about.
- meowface 10y agoI definitely understand the embargo, but this is one of those situations where the vuln was already fixed and it's likely very few malicious actors (possibly 0, but of course who knows) were aware of its existence. I feel like adding even just another day or two would've allowed them to purge more of these search results. I think that would greatly outweigh the increased risk of letting it remain undisclosed for slightly longer.
- ec109685 10y agoThank you for your thoughtful reply and realize the difficult situation you are in.
- tptacek 10y agoHah, no, my situation is super easy; it is "partisan bystander." I don't work for Google.
- i336_ 10y agoNot sure if you'll see this, but I've noticed that the cache links have been removed on literally all hits for these queries. And yet, I occasionally see working cache links on relevant unaffected pages. Really, really awesome to see this kind of response. It's an obvious course of action (also considering corporate liability that you're publicly holding/offering this data) but it's really cool to see everyone work to fix this en masse so quickly. I think a lot of people would enjoy hearing campfire battle stories of the past ~week once this is all over.